The comparison between the current inventory and the published page is built from every current inventory page. When something changes, the last complete comparison stays on screen and is brought up to date about a second after the changes stop. While packages are still being checked, it is brought up to date once the check is done. A failed comparison offers Retry and does not change the frozen published revision.
Readers of the public attestation page always see the last published third-party license disclosure. Edits after that publish create unpublished changes (drift). The Projects overview Drift tab and Drift column, the project page header, the out-of-date banner, and Publication status summarize the live-vs-published diff as packages added, updated, or removed (not only a rolled-up count), and call out packages not yet on the public attestation page.
Changes, the publish summary, and revision comparisons retain every reviewed component occurrence, including multiple versions and repeated legal claims. Equal claims cancel one at a time. An unambiguous upgrade can show as a change; ambiguous variant changes appear as separate additions and removals. Attestation details changed means the public page needs a new publish even though no component rows changed. This includes company details, certification wording, enabled AI disclosures, distribution scope, an addendum, and project metadata; the summary does not identify which detail changed.
Changes tab
Open the Changes tab for the full lists: packages added or removed and every changed published field (exact name casing, version, license name or SPDX identifier, copyright holder, ecosystem, upstream repository URL, source URL, license-text presence, license URL, and copyleft or network flags), plus packages still needing review that stay off the public attestation page until they are live. Inline license bodies are never copied into the change description.
- Publish changes: Push the current Live inventory to the public page as a new revision.
- Blocked: An approved component still missing license text or an external obligation. Fix or un-approve before publishing.
Email alerts
When a connected repo sync or release leaves packages waiting for review, SourceTrust opens a drift window and later sends a daily consolidated digest (not an email on every sync). See Help center → Dependency change digests (Dependency change digests) for timing, escalation, and how to turn digests off. Who gets those emails (and security alerts) is controlled by Project leads (Project leads).